Analysis method and system for actual combat attack and defense confrontation

Abstract

The invention provides an analysis method and system for actual combat attack and defense confrontation, and the method comprises the steps: constructing a multi-source heterogeneous data set fusion technology, providing deep analysis of interfaces for related safety capability probes and platforms, combing interface data fields of heterogeneous probes or platforms, and carrying out the unified comparison of the field information of the safety capability probes and the platform, thereby achieving the real combat attack and defense confrontation. Security data baselines under the same product type are established, a knowledge graph technology is applied in the field of protected object association to realize structured and visual expression of association relationships between protected objects and associated elements thereof, and based on a trusted data set, alarm information of a technical level is deeply associated with the protected objects in an organization range, so that the security of the protected objects is improved. A protection object-security risk-intelligence algorithm is automatically modeled, a layer of algorithm model is overlaid on the protection object, trusted data and security risk algorithms, known threats are accurately and rapidly handled, accurate noise reduction of mass data and automatic analysis, research and judgment of security events are achieved, and the security risk-security risk-intelligence algorithm is obtained. The problem that systematic confrontation and systematic risks cannot be handled in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an analysis method and system for actual attack and defense confrontation. Background Art

[0002] With the rapid advancement of digital transformation, the industry has gradually moved from fragmentation to intensiveness, and from decentralization to integration. Business and information technology have become increasingly closely integrated, and a digital system has been formed that runs through the enterprise from headquarters to branches. However, it has the characteristics of wide exposure, long attack chain, and complex linkage. The scope of protection has been ubiquitously extended to cloud, network, data, terminal and supply chain, and has moved towards the depth of the entire industry. Users have long faced systematic confrontation and systemic risks, and security has become practical.

[0003] Therefore, there is an urgent need for a targeted analysis method and system for actual offensive and defensive confrontation. Summary of the invention

[0004] The purpose of the present invention is to provide an analysis method and system for actual combat attack and defense confrontation, so as to provide multiple capabilities such as asset combing, exposure surface convergence, security situation awareness, etc., to realize business asset analysis and identification and basic association, to achieve risk data aggregation covering more than dozens of security capabilities, and to build an integrated closed loop of monitoring and early warning - rapid response - analysis and judgment - automated defense, so as to solve the problems of unclear assets, unknown risks, and missing processes and complete basic structured defense.

[0005] In a first aspect, the present application provides an analysis method for actual combat attack and defense confrontation, the method comprising:

[0006] Step 1: Sort out the trusted data set, including:

[0007] Obtain original massive data based on original traffic, host, and application;

[0008] Clarify the key security data fields corresponding to each security capability;

[0009] Extract security-related information based on massive amounts of original data;

[0010] According to the key security data fields, a security data baseline is sorted out for security related information to obtain a trusted data set;

[0011] Step 2: Build a practical scenario base library, including:

[0012] Based on the trusted data set, a practical scenario basic library is formed through key data association;

[0013] Step 3: Automatic modeling of protection object association, including:

[0014] Based on the results of the protection object account sorting, a protection object association model is constructed to visualize and structure the information business, IT assets and related elements in the form of a knowledge graph;

[0015] Step 4: Automated assessment and modeling of known security risks from multiple sources, including:

[0016] By structuring and standardizing various types of alarms, automatically defining the alarm sources as data labels, and ensuring that the alarm levels of the probes are reasonable, we can summarize the three levels of alarms, sort out the alarm categories and alarm subtypes, establish a conflict game model, and quantitatively analyze the impact of alarms as conflict game objects on visualization and structured expression through their learning ability;

[0017] According to the different characteristics, scale, and quality of alarm data at different stages, and the different other data resources that can be used for correlation analysis, the alarm data is filtered and denoised;

[0018] The alarm data is associated with behaviors, impacts on visualization and structured expressions, and multiple types of attribute data to generate network security events, present complete event content, and automatically analyze and identify known threats.

[0019] In a second aspect, the present application provides an analysis system for actual combat attack and defense confrontation, the system comprising: a data generation module, a scene generation module, an object association module, an automatic analysis module and an analysis configuration module;

[0020] The data generation module is used to sort out the trusted data set, including:

[0021] Obtain original massive data based on original traffic, host, and application;

[0022] Clarify the key security data fields corresponding to each security capability;

[0023] Extract security-related information based on massive amounts of original data;

[0024] According to the key security data fields, a security data baseline is sorted out for security related information to obtain a trusted data set;

[0025] The scenario generation module is used to build a practical scenario basic library, including:

[0026] Based on the trusted data set, a practical scenario basic library is formed through key data association;

[0027] The object association module is used to protect the object association automatic modeling, including:

[0028] Based on the results of the protection object account sorting, a protection object association model is constructed to visualize and structure the information business, IT assets and related elements in the form of a knowledge graph;

[0029] The automatic assessment module is used for automatic assessment and modeling of known security risks from multi-source fusion, and includes:

[0030] By structuring and standardizing various types of alarms, automatically defining the alarm sources as data labels, and ensuring that the alarm levels of the probes are reasonable, we can summarize the three levels of alarms, sort out the alarm categories and alarm subtypes, establish a conflict game model, and quantitatively analyze the impact of alarms as conflict game objects on visualization and structured expression through their learning ability;

[0031] According to the different characteristics, scale, and quality of alarm data at different stages, and the different other data resources that can be used for correlation analysis, the alarm data is filtered and denoised;

[0032] Generate network security events by associating alarm data with behaviors, impact on visualization and structured expression, and attribute multiple types of data, present complete event content, and automatically analyze and identify known threats;

[0033] The analysis configuration module is used to build an analysis configuration platform.

[0034] In a third aspect, the present application provides an analysis system for actual combat attack and defense confrontation, the system comprising a processor and a memory:

[0035] The memory is used to store program code and transmit the program code to the processor;

[0036] The processor is used to execute any one of the four possible methods of the first aspect according to the instructions in the program code.

[0037] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to be executed by a processor to implement any one of the four possible methods in the first aspect.

[0038] Beneficial Effects

[0039] The present invention provides an analysis method and system for actual combat attack and defense confrontation. By constructing a multi-source heterogeneous data set fusion technology, through in-depth analysis of the interfaces provided by relevant security capability probes and platforms, the interface data fields of heterogeneous probes or platforms are sorted out, and the security capability probes and platform field information are uniformly compared to establish a security data baseline under the same product type. In the field of protection object association, the knowledge graph technology is applied to realize the structured and visual expression of the association relationship between the protection object and its associated elements. Based on the trusted data set, the technical level alarm information is deeply associated with the protection objects within the organization. The protection object-security risk-intelligence algorithm is automatically modeled, and a layer of algorithm model is superimposed on the protection object, trusted data, and security risk algorithm. Known threats are handled accurately and quickly, and accurate noise reduction of massive data and automatic analysis and judgment of security incidents are realized, thereby overcoming the problem that the existing technology cannot cope with systematic confrontation and systemic risks.

[0040] The method and system of the present invention have the following advantages and effects:

[0041] It abandons the traditional single log source data approach, eliminates the problems of insufficient data content richness and single data type, and adopts multiple methods such as API, syslog, URL, etc. to obtain and integrate multi-source heterogeneous data sets to form a trusted data set, providing trusted data support for accurate analysis and judgment.

[0042] In the field of protection object association, knowledge graph technology is applied to achieve structured and visual expression of the relationship between protection objects and their related elements, and to realize automatic, clear and intuitive sorting of protection objects; in the field of raw security data processing and judgment, machine learning algorithms such as random forests and unsupervised clustering are applied, and at the same time, similarity comparison, deduplication, aggregation, whitelist and other technical means are adopted for the monitored relevant alarm information to achieve accurate noise reduction of massive data and automatic analysis and judgment of security incidents.

[0043] Automated modeling of protection object-security risk-intelligence algorithm superimposes a layer of algorithm model on the protection object, trusted data, and security risk algorithms to accurately and quickly handle known threats, raising the security analysis and judgment capability set to an automated level. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 A flowchart for combing the safety data baseline of the present invention;

[0046] Figure 2 It is a system architecture diagram of the present invention. DETAILED DESCRIPTION

[0047] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0048] The present application provides an analysis method for actual combat attack and defense confrontation, the method comprising:

[0049] Step 1: Sort out the trusted data set, including:

[0050] Obtain original massive data based on original traffic, host, and application;

[0051] Clarify the key security data fields corresponding to each security capability;

[0052] Extract security-related information based on massive amounts of original data;

[0053] According to the key security data fields, a security data baseline is sorted out for security related information to obtain a trusted data set;

[0054] In some preferred embodiments, the security-related information includes: one or more of: security capability alarms, system and traffic error logs, authentication behavior records, and access records.

[0055] According to the key security data fields, a security data baseline is compiled for security-related information to ensure that at least five event analysis elements are covered: the time of the event, the assets affected by the event, the event behavior process, the personnel involved in the event, and the impact of the event on disk.

[0056] In some preferred embodiments, the security data baseline includes: one or more of a security capability alarm baseline, a system and traffic error log baseline, and an authentication behavior record baseline.

[0057] The security data baseline is enriched with data content to obtain a trusted data set.

[0058] Step 2: Build a practical scenario base library, including:

[0059] Based on the trusted data set, a practical scenario basic library is formed through key data association;

[0060] The practical scenario basic library includes a variety of basic analysis methods.

[0061] Step 3: Automatic modeling of protection object association, including:

[0062] Based on the results of the protection object account sorting, a protection object association model is constructed to visualize and structure the information business, IT assets and related elements in the form of a knowledge graph;

[0063] It can clarify business carrying, open ports and component information, and asset ownership, help clarify the relationship between protection objects, and when a security incident occurs, it can quickly associate and locate the affected IT assets based on a certain influencing factor, reducing the pressure on analysts to disassemble and sort out protection objects.

[0064] Step 4: Automated assessment and modeling of known security risks from multiple sources, including:

[0065] By structuring and standardizing various types of alarms, automatically defining the alarm sources as data labels, and ensuring that the alarm levels of the probes are reasonable, we can summarize the three levels of alarms, sort out the alarm categories and alarm subtypes, establish a conflict game model, and quantitatively analyze the impact of alarms as conflict game objects on visualization and structured expression through their learning ability;

[0066] In actual applications, the two alarms choose cooperation to consider the influence of the control scheme of the adjacent objects, and betrayal to ignore the influence of the control scheme of the adjacent objects. Each alarm is a pure strategist, and there are only two strategies to choose from: cooperation to take the global optimum as the goal, and betrayal to take the individual optimum as the goal.

[0067] In a game process, the total payoff of a certain alarm is the sum after traversing all interacting neighbors in one iteration.

[0068] For alarms, the total benefit can be adjusted by adjusting the benefit matrix.

[0069] According to the different characteristics, scale, and quality of alarm data at different stages, and the different other data resources that can be used for correlation analysis, the alarm data is filtered and denoised;

[0070] Generate network security events by associating alarm data with behaviors, impact on visualization and structured expression, and attribute multiple types of data, present complete event content, and automatically analyze and identify known threats;

[0071] This application does not use the massive data lake model to build a trusted data set. It builds multi-source heterogeneous data set fusion technology, through in-depth analysis of the interfaces provided by relevant security capability probes and platforms, combs the interface data fields of heterogeneous probes or platforms, and uniformly compares the security capability probes and platform field information of different manufacturers, brands, types, and versions, and summarizes them into a data set list. Based on security business needs, a security data baseline under the same product type is established.

[0072] It abandons the traditional single log source data approach, eliminates the problems of insufficient data content richness and single data type, and adopts multiple methods such as API, syslog, URL, etc. to obtain and integrate multi-source heterogeneous data sets to form a trusted data set, providing trusted data support for accurate analysis and judgment.

[0073] This application is an automated modeling of the protection object-security risk-intelligence algorithm. In the field of protection object association, the knowledge graph technology is applied to realize the structured and visual expression of the association relationship between the protection object and its associated elements, and to realize the automated clear and intuitive sorting of the protection object;

[0074] Automated modeling of protection object-security risk-intelligence algorithm superimposes a layer of algorithm model on the protection object, trusted data, and security risk algorithms to accurately and quickly handle known threats, raising the security analysis and judgment capability set to an automated level.

[0075] Figure 2 The architecture diagram of the analysis system for actual combat attack and defense provided by the present application, the system includes: a data generation module, a scene generation module, an object association module, an automatic analysis module and an analysis configuration module;

[0076] The data generation module is used to sort out the trusted data set, including:

[0077] Obtain original massive data based on original traffic, host, and application;

[0078] Clarify the key security data fields corresponding to each security capability;

[0079] Extract security-related information based on massive amounts of original data;

[0080] According to the key security data fields, a security data baseline is sorted out for security related information to obtain a trusted data set;

[0081] The scenario generation module is used to build a practical scenario basic library, including:

[0082] Based on the trusted data set, a practical scenario basic library is formed through key data association;

[0083] The object association module is used to protect the object association automatic modeling, including:

[0084] Based on the results of the protection object account sorting, a protection object association model is constructed to visualize and structure the information business, IT assets and related elements in the form of a knowledge graph;

[0085] The automatic assessment module is used for automatic assessment and modeling of known security risks from multi-source fusion, and includes:

[0086] By structuring and standardizing various types of alarms, automatically defining the alarm sources as data labels, and ensuring that the alarm levels of the probes are reasonable, we can summarize the three levels of alarms, sort out the alarm categories and alarm subtypes, establish a conflict game model, and quantitatively analyze the impact of alarms as conflict game objects on visualization and structured expression through their learning ability;

[0087] According to the different characteristics, scale, and quality of alarm data at different stages, and the different other data resources that can be used for correlation analysis, the alarm data is filtered and denoised;

[0088] Generate network security events by associating alarm data with behaviors, impact on visualization and structured expression, and attribute multiple types of data, present complete event content, and automatically analyze and identify known threats;

[0089] The analysis configuration module is used to build an analysis configuration platform.

[0090] The present application provides an analysis system for actual combat attack and defense confrontation, the system comprising: the system comprising a processor and a memory:

[0091] The memory is used to store program code and transmit the program code to the processor;

[0092] The processor is used to execute the method described in any one of all embodiments of the first aspect according to the instructions in the program code.

[0093] The present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program code, and the program code is used to be executed by a processor to implement the method described in any one of all the embodiments of the first aspect.

[0094] In a specific implementation, the present invention further provides a computer storage medium, wherein the computer storage medium may store a program, and when the program is executed, the program may include some or all of the steps in each embodiment of the present invention. The storage medium may be a disk, an optical disk, a read-only storage memory (abbreviated as: ROM) or a random access memory (abbreviated as: RAM), etc.

[0095] Those skilled in the art can clearly understand that the technology in the embodiments of the present invention can be implemented by means of software plus a necessary general hardware platform. Based on this understanding, the technical solution in the embodiments of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention or some parts of the embodiments.

[0096] The same and similar parts between the various embodiments of this specification can be referred to each other. In particular, for the embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the description in the method embodiment.

[0097] The above-described embodiments of the present invention do not limit the protection scope of the present invention.

Claims

1. An analysis method for actual combat attack and defense confrontation, characterized in that: The method comprises: Step 1: Sort out the trusted data set, including: Obtain original massive data based on original traffic, host, and application; Clarify the key security data fields corresponding to each security capability; Extract security-related information based on massive amounts of original data; According to the key security data fields, a security data baseline is sorted out for security related information to obtain a trusted data set; Step 2: Build a practical scenario base library, including: Based on the trusted data set, a practical scenario basic library is formed through key data association; Step 3: Automatic modeling of protection object association, including: Based on the results of the protection object account sorting, a protection object association model is constructed to visualize and structure the information business, IT assets and related elements in the form of a knowledge graph; Step 4: Automated assessment and modeling of known security risks from multiple sources, including: By structuring and standardizing various types of alarms, automatically defining the alarm sources as data labels, and ensuring that the alarm levels of the probes are reasonable, we can summarize the three levels of alarms, sort out the alarm categories and alarm subtypes, establish a conflict game model, and quantitatively analyze the impact of alarms as conflict game objects on visualization and structured expression through their learning ability; According to the different characteristics, scale, and quality of alarm data at different stages, and the different other data resources that can be used for correlation analysis, the alarm data is filtered and denoised; The alarm data is associated with behaviors, impacts on visualization and structured expressions, and multiple types of attribute data to generate network security events, present complete event content, and automatically analyze and identify known threats.

2. The method according to claim 1, characterized in that: The security-related information includes: one or more of: security capability alarms, system and traffic error logs, authentication behavior records, and access records.

3. The method according to claim 1, characterized in that: The security data baseline includes: one or more of: a security capability alarm baseline, a system and traffic error log baseline, and an authentication behavior record baseline.

4. An analysis system for actual combat attack and defense confrontation, characterized in that: The system includes: a data generation module, a scene generation module, an object association module, an automatic analysis module and an analysis configuration module; The data generation module is used to sort out the trusted data set, including: Obtain original massive data based on original traffic, host, and application; Clarify the key security data fields corresponding to each security capability; Extract security-related information based on massive amounts of original data; According to the key security data fields, a security data baseline is sorted out for security related information to obtain a trusted data set; The scenario generation module is used to build a practical scenario basic library, including: Based on the trusted data set, a practical scenario basic library is formed through key data association; The object association module is used to protect the object association automatic modeling, including: Based on the results of the protection object account sorting, a protection object association model is constructed to visualize and structure the information business, IT assets and related elements in the form of a knowledge graph; The automatic assessment module is used for automatic assessment and modeling of known security risks from multi-source fusion, and includes: By structuring and standardizing various types of alarms, automatically defining the alarm sources as data labels, and ensuring that the alarm levels of the probes are reasonable, we can summarize the three levels of alarms, sort out the alarm categories and alarm subtypes, establish a conflict game model, and quantitatively analyze the impact of alarms as conflict game objects on visualization and structured expression through their learning ability; According to the different characteristics, scale, and quality of alarm data at different stages, and the different other data resources that can be used for correlation analysis, the alarm data is filtered and denoised; Generate network security events by associating alarm data with behaviors, impact on visualization and structured expression, and attribute multiple types of data, present complete event content, and automatically analyze and identify known threats; The analysis configuration module is used to build an analysis configuration platform.

5. An analysis system for actual combat attack and defense confrontation, characterized in that: The system comprises a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is used to execute the method according to any one of claims 1 to 3 according to the instructions in the program code.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program codes, and the program codes are used to be executed by a processor to implement the method according to any one of claims 1 to 3.

Images